The counts, the per-title numbers and the counting script stay in the PR, as the review asks. The entry now says that the type argument is the constant 0 or 1 at every call site of the 14 titles that call the function directly from the executable.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Extends the entry by one sentence of counts: 14 of 53 local titles call the function directly at 149 sites; the third argument is the constant 0 at 30 and 1 at 14 of the 44 sites read by two counts, and PPSA10261's 105 sites carry 1 at 101 and 0 at 4 in one count, which the second count checks without contradiction. Counts only; nothing is claimed about console behavior.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Adds the missing full stop after the original sentence and states that the 13 titles call both functions directly from the executable, so the entry does not read as if the other titles never call them.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Extends the entry by one sentence of counts: 13 of 53 local titles call both functions once each, from one wrapper in the title's library code that passes the operation as a byte and zeroes two arguments for operation 7. Counts and a description of the title code only; nothing is claimed about console behavior.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Kept main's new debt entries next to this PR's FuseShaderHalves entry, and stated that entry's behaviour without naming a source.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a PS5 the builder writes 15 dwords: a tag write of 0xc6000006, opcode 0x3a with its arguments, initiator 0x80 whatever the modifier, and a closing tag write; GetSize returns 60. AnyPS5 wrote NUM_INSTANCES and DRAW_INDEX_2 under argument meanings nothing confirms. The driver refuses 0x3a, whose field meanings are not known, and names it DRAW_INDEX_MULTI_INST as Linux's nvd.h does.
On a PS5, sceAgcAcbWaitOnAddressGetSize and sceAgcDcbWaitOnAddressGetSize return 56 for size 0, 64 for size 1 and 0 for any other 32-bit value, and sceAgcDcbContextStateOpGetSize returns 0 for an operation above 3. The ACB wait size takes a 32-bit argument instead of a byte.
The firmware writes only the back half's SH register list into the
caller's memory, and its size query reports eight bytes per back
register for geometry halves too.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01SNqSvnFwRBz3D76n476yw6
PPSA03396 calls sceAgcAcbMemSemaphore and sceAgcDcbMemSemaphore as
(cb, address, waitForMailbox, signalType, operation). Both read the
address from the fourth argument instead, so the call aborted with
"null or misaligned address 0x1".
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAgcCbSetShRegistersDirect and sceAgcCbSetUcRegistersDirect now accept
a list at any byte address because PPSA26344 passes lists at 1 mod 4.
The debt entry names that title evidence and states that how the console
reads such a list is not measured, so the host behaviour is not taken for
a measured console contract.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean